AgentCore Gateway Enables Private TLS Certificate Support for Secure VPC Endpoint Connections

Amazon Bedrock AgentCore Gateway extended support for TLS certificates signed by private CAs, enabling native secure connections to private VPC endpoints.

By Amelia Ross · Editorial pseudonym · 2026-10-02 · 1 min read

AI-ASSISTED REPORTING · RETROSPECTIVE ARCHIVE

Retrospective edition: 2026-10-02. Source published: 2026-10-02. Added to this archive: 2026-11-03. This briefing was prepared later from the linked announcement; it was not published on this website on the historical edition date.

Previously, AgentCore Gateway supported public TLS certificates; with this update, it accepts certificates from private certificate authorities (CAs). This allows secure communication to targets using private endpoints powered by Amazon VPC Lattice without requiring an Application Load Balancer as an intermediary.

Users can register private CA certificates stored in Amazon S3 or Secrets Manager as trust anchors, which the gateway uses to validate outbound TLS connections. This capability is available globally in regions where both AgentCore Gateway and VPC Lattice operate, supporting MCP server, OpenAPI, and HTTP proxy targets.

Source & further reading

AgentCore Gateway supports private TLS certificates for VPC endpoints ↗

Source published 2026-10-02. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.